Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday

KB5087545

KB5087545: Cumulative update for Windows Server, version 2022, May 2026. Critical Netlogon flaw patched; BitLocker recovery risk remains

In short

Fixes 58 vulnerabilities, including five critical flaws, and addresses a Remote Desktop warning-dialog issue. Some BitLocker configurations might prompt for a recovery key after the first restart.

Does it affect you? Applies to: Devices running Windows Server 2022. The package listed in the dossier is for x64 systems.

Build
20348.5139
Security
58 fixed · 5 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes Some users may get a “no Internet” error when signing in to Microsoft-account apps after updates released on or after March 10, 2026, even when connected to the Internet. This page does not say that KB5087545 fixes the issue.

The official sources are linked at the end of the page.

What changes

Improvements 6 changes

Secure Boot

Gradual rollout Verified in package
  • More eligible devices can receive new Secure Boot certificates automatically, through a controlled rollout that waits for successful update signals.1
    Windows quality updates include additional high-confidence device-targeting data; certificate delivery is phased and depends on sufficient successful update signals.

App

For: Users and developers

  • Apps and system components get more consistent calculation results, especially when working with very small values.2
    Improves the accuracy and reliability of calculations used by apps and system components.

Daylight saving time (DST)

For: Devices configured for the Arab Republic of Egypt

  • Time handling supports the 2023 daylight saving time change for the Arab Republic of Egypt.3

Desktop

  • The Windows Server interface responds more smoothly during everyday use, with fewer instances of windows stopping responding.4

Sign-In

For: Some users signing in to Microsoft-account apps

  • Some users might see a “no Internet” error when signing in to apps with a Microsoft account, even when the device has an Internet connection.5
    The page describes the issue after installing Windows updates released on or after March 10, 2026; it does not say this update resolves it.

Servicing stack

For: Windows Server 2022 devices

  • The component that installs Windows updates gets quality improvements.6
    The cumulative update includes servicing stack update KB5089140, build 20348.5120.

Fix 1 change

Remote Desktop

Verified in package

For: Devices using Remote Desktop across monitors with different scaling

  • The Remote Desktop Connection security warning dialog’s rendering issue is addressed for multi-monitor setups with different scaling.7
    The issue might occur after installing the April 2026 security update, KB5082142.

New feature 1 change

Secure Boot

Verified in package
  • Eligible devices get a new C:\Windows\SecureBoot folder containing sample scripts for checking certificate-update status and managing deployment.8
    The scripts are intended for IT professionals managing device fleets and can automate deployment through a safe rollout mechanism in an Active Directory environment.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not display synchronization error details after KB5070884 or later updates. This functionality is temporarily removed to address CVE-2025-59287.9

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    A limited number of devices might ask for the BitLocker recovery key on the first restart after this update when all of these conditions apply: BitLocker is enabled on the OS drive; the policy “Configure TPM platform validation profile for native UEFI firmware configurations” includes PCR7, or its equivalent registry setting is used; msinfo32.exe reports PCR7 Binding as “Not Possible”; the Windows UEFI CA 2023 certificate is in the Secure Boot Signature Database; and the device is not already using the 2023-signed Windows Boot Manager. The key is needed only once if the policy stays unchanged.10

    How to apply the workaround Group Policy

    This updates BitLocker bindings to use the Windows-selected default PCR profile.10

    Step-by-step instructions, command & download kit
    5 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Check the listed BitLocker, policy, PCR7, certificate, and boot-manager conditions on affected devices.
    2. Open gpedit.msc or Group Policy Management Console and go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    3. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured before installing the update.
    4. Run the policy refresh command on affected devices.
    5. Where BitLocker is enabled on the C: drive, disable and then re-enable its protectors.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5091575, KB5082142, KB5078766, KB5082314
+36 earlier KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5094128
VersionBuildChannel
2022 20348.5139 General availability

Security

58 vulnerabilities fixed
5 critical 53 important
VulnerabilitySeverityCVSS
CVE-2026-41089
Windows Netlogon Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-40402
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 9.3
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 58 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
539.4 MB
windows10.0-kb5087545-x64.msu Main update · KB5087545 SHA-1: 2f3249fe…5c7133

Updated components

892 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display10
Hyper-V and virtualization8
Networking8
File Explorer and shell5
Search5
Security and sign-in5
Kernel4
Secure Boot4
Printing3
Remote Desktop3
Storage and file systems2
Windows Update2

Verified in package: changed files confirm Secure Boot, Remote Desktop.

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update improves the accuracy and reliability of calculations used by apps and system components. support.microsoft.com
  3. 3. This update supports the 2023 DST change for the Arab Republic of Egypt. support.microsoft.com
  4. 4. This update improves how the Windows Server interface responds during everyday use. support.microsoft.com
  5. 5. After you install the Windows update released on or after March 10, 2026, some users might experience an issue signing in to apps with a Microsoft account. support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. Fixed: This update addresses an issue that affects the Remote Desktop Connection security warning dialog. support.microsoft.com
  8. 8. This update adds a new SecureBoot folder under C:\Windows on eligible devices. support.microsoft.com
  9. 9. After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. support.microsoft.com
  10. 10. Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake